Splunk Dashboard Unspecified HTML Injection Vulnerability
BID:71257
Info
Splunk Dashboard Unspecified HTML Injection Vulnerability
| Bugtraq ID: | 71257 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-5466 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 19 2014 12:00AM |
| Updated: | Nov 19 2014 12:00AM |
| Credit: | Adam Bell / Lateral Security |
| Vulnerable: |
Splunk Splunk 6.1.1 Splunk Splunk 6.1 Splunk Splunk 6.0.6 Splunk Splunk 6.0.3 Splunk Splunk 6.0.2 Splunk Splunk 6.0.1 Splunk Splunk 6.0 Splunk Splunk 5.0.6 Splunk Splunk 5.0.5 Splunk Splunk 5.0.4 Splunk Splunk 5.0.2 Splunk Splunk 5.0 Splunk Splunk 6.1.3 Splunk Splunk 6.1.2 Splunk Splunk 6.0.4 Splunk Splunk 5.0.9 Splunk Splunk 5.0.8 Splunk Splunk 5.0.3 Splunk Splunk 5.0.1 |
| Not Vulnerable: |
Splunk Splunk 6.1.4 Splunk Splunk 6.0.7 Splunk Splunk 5.0.10 |
Discussion
Splunk Dashboard Unspecified HTML Injection Vulnerability
Splunk is prone to an unspecified HTML-injection vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Splunk is prone to an unspecified HTML-injection vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Exploit / POC
Splunk Dashboard Unspecified HTML Injection Vulnerability
Attackers can exploit this issue using browser.
Attackers can exploit this issue using browser.